Shopify 店铺面临疑似 AI 驱动的网络攻击
Shopify Stores Face Suspected AI-Driven Attacks
- 1德国工程师 Roman Zipp 在 Shopify 店铺结账时发现异常域名，源码含跳转伪造结账页的代码
- 2恶意代码不在 Shopify 平台本身，而在商家通过 Shopify App Store 安装的第三方扩展中
- 3伪造结账页疑似用于骗取购物者个人信息，当事人称由此发现一系列电商网络攻击
- 4Adweek 标题称这批攻击疑似由 AI 驱动，文中未详述关联细节
电商平台自身安全不等于商家店铺安全，第三方插件生态正在成为新的攻击面，结账环节的消费者信任可被用于骗取个人信息。
- 影响：经 Shopify 等平台开店的商家，安全边界不止平台本身还包括自行安装的每个第三方插件；结账页被劫持会直接波及支付数据与消费者信任；商家对插件的选型和审查成本会上升。
- 参考：可考虑盘点店铺已安装的第三方应用清单，优先核查涉及结账与支付流程的插件；选购插件时值得把来源和安全记录纳入评估，并比照该案例留意结账页域名是否与店铺及平台一致。
- 依据：判断基于一名德国工程师对单个店铺源码的检查，经 Adweek 采访转述，属个例发现；攻击疑似 AI 驱动仅为报道标题口径，暂无 Shopify 官方回应或独立验证。
German-based software engineer Roman Zipp was buying a mechanical keyboard from a Shopify-powered storefront last month, when he discovered a series of ecommerce cyberattacks.
As he checked out, he noticed the URL was from a domain affiliated neither with Shopify nor the merchant, he told ADWEEK.
Examining the source code revealed a redirect to a fake checkout screen, likely meant to fool unsuspecting shoppers into handing over their personal information.
The code wasn’t in the Shopify platform itself, but a third-party extension used by the merchant via the Shopify App Store — a marketplace where sellers can find apps to add functionality to their storefronts, like recommendation engines or post-checkout upsell screens.
UNLOCK FULL ACCESS
Subscribe and get full access to the news, insights, and expertise that keep industry professionals ahead of the curve.
来源：Adweek · adweek.com